← Back

E107

e107

82 CVEs • 6 products

Products (6)

Click to collapse
Toggle
E107
e107
77 CVEs
E107 Cms
e107_cms
2 CVEs
Chatbox Plugin
chatbox_plugin
1 CVE
My Gallery
my_gallery
1 CVE
Alternate Profiles Plugin
alternate_profiles_plugin
1 CVE
Easyshop Plugin
easyshop_plugin
1 CVE

CVEs (82)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2006-3259
1E107
1E107
Apr 16, 2026
Jun 27, 2006
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) ep parameter to search.php and the (2) subject parameter in comment.php (aka the...Show more
Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) ep parameter to search.php and the (2) subject parameter in comment.php (aka the Subject field when posting a comment).Show less
CVE-2006-2591
1E107
1E107
Apr 16, 2026
May 25, 2006
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Unspecified vulnerability in e107 before 0.7.5 has unknown impact and remote attack vectors related to an "emailing exploit".
CVE-2006-2590
1E107
1E107
Apr 16, 2026
May 25, 2006
N/A· v4
N/A· v3
6.4 MEDIUM· v2
SQL injection vulnerability in e107 before 0.7.5 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVE-2006-2416
1E107
1E107
Apr 16, 2026
May 16, 2006
N/A· v4
N/A· v3
5.1 MEDIUM· v2
SQL injection vulnerability in class2.php in e107 0.7.2 and earlier allows remote attackers to execute arbitrary SQL commands via a cookie as defined in $pref['cookie_name'].
CVE-2006-0857
1E107
2Chatbox Plugin
E107
Apr 16, 2026
Feb 23, 2006
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Chatbox Plugin 1.0 in e107 0.7.2 allows remote attackers to inject arbitrary HTML or web script via a Chatbox, as demonstrated using a SCRIPT element.
CVE-2006-0682
1E107
1E107
Apr 16, 2026
Feb 15, 2006
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in bbcodes system in e107 before 0.7.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVE-2005-4224
1E107
1E107
Apr 16, 2026
Dec 14, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the email, hideemail, image, realname, signature, timezone, and xupexist parameters in...Show more
Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the email, hideemail, image, realname, signature, timezone, and xupexist parameters in signup.php, (2) the content_comment, content_rating, and content_summary parameters in subcontent.php, (3) the download_category and file_demo in upload.php, and (4) the email, hideemail, user_timezone, and user_xup parameters in usersettings.php.Show less
CVE-2005-4051
1E107
1E107
Apr 16, 2026
Dec 7, 2005
N/A· v4
N/A· v3
5.0 MEDIUM· v2
e107 0.6174 allows remote attackers to vote multiple times for a download via repeated requests to rate.php.
CVE-2005-3594
1E107
1E107
Apr 16, 2026
Nov 16, 2005
N/A· v4
N/A· v3
5.0 MEDIUM· v2
game_score.php in e107 allows remote attackers to insert high scores via HTTP POST methods utilizing the $player_name, $player_score, and $game_name variables.
CVE-2005-3521
1E107
1E107
Apr 16, 2026
Nov 6, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or script via the (1) a_name parameter or (2) us...Show more
SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or script via the (1) a_name parameter or (2) user field of the login page.Show less
CVE-2005-2805
1E107
1E107
Apr 16, 2026
Sep 6, 2005
N/A· v4
N/A· v3
5.0 MEDIUM· v2
forum_post.php in e107 0.6 allows remote attackers to post to non-existent forums by modifying the forum number.
CVE-2005-2559
1E107
1E107
Apr 16, 2026
Aug 16, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) shell metacharacters in the eping_count parameter or (2) restricted shell metachara...Show more
doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) shell metacharacters in the eping_count parameter or (2) restricted shell metacharacters such as ">" and "&" in the eping_host parameter, which is not handled by the validation function.Show less
CVE-2005-2327
1E107
1E107
Apr 16, 2026
Jul 20, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web script or HTML via nested [url] BBCode tags.
CVE-2005-1949
1E107
1E107
Apr 16, 2026
Jun 16, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
The eping_validaddr function in functions.php for the ePing plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacters after a valid argument to the eping_host parameter.
CVE-2005-1966
1E107
1E107
Apr 16, 2026
Jun 10, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
The eTrace_validaddr function in eTrace plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacters after a valid argument to the etrace_host parameter.
CVE-2004-2262
1E107
1E107
Apr 16, 2026
Dec 31, 2004
N/A· v4
N/A· v3
7.5 HIGH· v2
ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to execute arbitrary code by uploading a PHP file via the upload parameter to images.php.
CVE-2004-2042
1E107
1E107
Apr 16, 2026
May 29, 2004
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary SQL code and gain sensitive information via (1) content parameter to content.php, (2) content_id parameter to content.php, o...Show more
Multiple SQL injection vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary SQL code and gain sensitive information via (1) content parameter to content.php, (2) content_id parameter to content.php, or (3) list parameter to news.php.Show less
CVE-2004-2040
1E107
1E107
Apr 16, 2026
May 29, 2004
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN_407 parameter to clock_menu.php, (2) "email article to a friend" field, (3)...Show more
Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN_407 parameter to clock_menu.php, (2) "email article to a friend" field, (3) "submit news" field, or (4) avmsg parameter to usersettings.php.Show less
CVE-2004-2039
1E107
1E107
Apr 16, 2026
May 29, 2004
N/A· v4
N/A· v3
5.0 MEDIUM· v2
e107 0.615 allows remote attackers to obtain sensitive information via a direct request to (1) alt_news.php, (2) backend_menu.php, (3) clock_menu.php, (4) counter_menu.php, (5) login_menu.php, and other files, which reve...Show more
e107 0.615 allows remote attackers to obtain sensitive information via a direct request to (1) alt_news.php, (2) backend_menu.php, (3) clock_menu.php, (4) counter_menu.php, (5) login_menu.php, and other files, which reveal the full path in a PHP error message.Show less
CVE-2004-2031
1E107
1E107
Apr 16, 2026
May 21, 2004
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in user.php in e107 allows remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) MSN, or (3) AIM fields.